Rolling out a Content-Security-Policy without breakage
Start in report-only mode, read the reports for a while, then enforce. The order matters more than the policy you write first.
Category
Web Development
Browser behaviour, HTTP details and front-end performance for teams that already run production sites.
Service worker updates: why users keep the old version
A new service worker installs, then waits. Until you understand why, deployments seem to have no effect on some users for days.
CORS preflights: what triggers them and what you can cache
Every OPTIONS request in your logs is a preflight the browser decided it needed. Knowing the rules lets you remove half of them.
Vary: Cookie quietly destroys your CDN hit rate
A single Vary: Cookie header turns every visitor into their own cache entry. Here is how it sneaks in, and how to keep cacheable pages cacheable.
Cache-Control: no-cache does not mean what you think
no-cache still stores the response. The directive that forbids storing is no-store, and the difference matters for CDNs, browsers and privacy reviews.
font-display, preload and the crossorigin you forgot
Preloading a font without crossorigin makes the browser download it twice. The choice of font-display decides what users see while it loads.
